Prerequisites for configuring KCD for BlackBerry Dynamics apps

Item

Description

Active Directory port

Port 88 on the Active Directory service must be accessible by all UEM servers.

Kerberos environment
The Kerberos environment must include the following components:
  • Microsoft Active Directory server: The directory service that authenticates and authorizes all users and computers associated with your Windows network.
  • Kerberos Key Distribution Center (KDC): The authentication service on the Active Directory server that supplies session tickets and keys to users and computers in the Active Directory domain.
  • To use KCD with Microsoft 365 resources, the on-premises Active Directory domain must be integrated with Entra. For more information, see the Microsoft article "Integrate on-premises AD with Entra".

krb5.conf file

Your UEM environment requires a krb5.conf file with values specific to your KDC. It must include the following minimum settings:

AES Keytab file:

[libdefaults]
    forwardable = true

If you use an AES Keytab file, you must create the file with an AES flag of /crypto AES128-SHA1 or /crypto AES256-SHA1:

ktpass /out outfilename.keytab /mapuser kerberos_account@REALM_IN_ALL_CAPS /princ GCSvc/UEM@REALM_IN_ALL_CAPS /pass kerberos_account_password /ptype KRB5_NT_SRV_HST /crypto AES256-SHA1

The value you specify for /princ must be a unique SPN in the domain that will be associated with the service account when the keytab file is created.

You must specify the location of the krb5.conf file in Settings > BlackBerry Dynamics > Properties (see Configure KCD for BlackBerry Dynamics apps). For more information about constructing a krb5.conf file, see the MIT Kerberos Documentation.

Service Principal Names (SPN)

Create SPNs for all HTTP services, including the BlackBerry Enterprise Mobility Server. You must set an SPN for every target resource you want devices to have access to.

For more information about how to create and modify SPNs, see Register a Service Principal Name for Kerberos Connections.

Multi-realm Kerberos environments
  • A minimum of one UEM Core must be installed in each Kerberos realm. UEM must reside in the same Kerberos realm as the resource because cross-realm resource delegation is not supported.
  • Ensure that single-realm KCD is working before configuring multi-realm KCD.
  • All trusts must be bidirectional, transitive forest trust.
  • Ensure a maximum of 5 ms latency between the UEM Core instances and the Microsoft SQL Server database.
  • For each UEM Core instance, use a separate service account with its own unique SPN set and generated keytab file (you can reuse the same account and keytab file on other UEM servers in the same realm).
Note: If you upgrade from UEM version 12.19 or earlier to UEM 12.20 or later, you must do the following:
  1. Generate a new Kerberos keytab file and copy it to each UEM server (see step 2 in Configure KCD for BlackBerry Dynamics apps).
  2. In Settings > BlackBerry Dynamics > Properties, in the Service account name under which KCD service is running (gc.krb5.principal.name) field, specify the following: 
    GCSvc/<UEM_Core_host_machine>@<KERBEROS_REALM_IN_UPPERCASE>